Covenant Guard

[Covenant: an operating system that builds itself]

Covenant

[CI] [kani] [License: Apache-2.0] [DOI] [Rust]

Open infrastructure for agent-native computing.

[Covenant architecture: clients reach covenantd over CLI / IPC / HTTP / MCP / A2A; the daemon dispatches through eight primitives over a cross-cutting audit layer running on an unprivileged Linux/macOS host.]

Covenant sits below agent applications and above the host operating system. It owns the state, authority, and accountability concerns that recur across agent frameworks — scoped capabilities, durable memory, runtime isolation, append-only audit, and commit-scoped provenance — so individual frameworks can stop reinventing them.

Status. Local control plane is real and live-tested (50 Rust crates, ~284k lines, 3870 source-discovered Rust tests including 486 live boundary tests). Production-grade sandboxing for hostile agent code and networked multi-peer operation are roadmap; the Solana settlement program is deployed on mainnet (credits, staking, slashing, on-chain receipt anchoring), but its daemon-driven economic lifecycle is not yet production. See BUILT.md for the explicit honesty boundary.

Multi-chain reach. The trust layer also projects onto Base mainnet as signed statements any EVM contract verifies with one ecrecover — ERC-8004 agent registration, a deployed bond-receipt verifier, a registered EAS reputation schema, and an ENS CCIP-Read gateway (*.agents.opencovenant.eth) — while $CVNT stays a single Solana mint that is never bridged or wrapped and every per-call fee and bond is chain-local USDC. On-chain reputation writes and funded USDC bonds are registered but not yet exercised, while live x402 sellers settle chain-local USDC on both Solana and Base mainnet, and on Robinhood Chain mainnet (chain 4663) a USDG x402 payment and an on-chain bounded-spend escrow are proven with real USDG. See docs/multichain-value-capture.md.

• Web: opencovenant.org
• Docs: docs.opencovenant.org
• Paper: DOI: 10.5281/zenodo.20134416
• Token: $CVNT · 2mNVZ6aEjrGwiUVCfz7XGWpiXuWzgBDoznwE579upump

Quick start

Try it without installing — sandbox.opencovenant.org. Public operator console wired to a live daemon, state resets every 12 hours.

To run it locally, build the daemon and CLI, register the sample agent, and start the daemon:

git clone https://github.com/open-covenant/covenant && cd covenantcd agent-os && cargo build --workspace --exclude covenant-settlement-program --locked
# Register the example agent (daemon loads $COVENANT_HOME/agents/ at startup)mkdir -p ~/.covenant/agentscp -R ../examples/hello-agent ~/.covenant/agents/hello
# Start the daemon./target/debug/covenantd

Then drive it from either surface — they share the same daemon, audit chain, and capability store.

CLI

./target/debug/covenant capabilities grant memory.write./target/debug/covenant capabilities grant intent.subscribe./target/debug/covenant intent "say hello"

Operator console — a Next.js UI for dispatching intents, browsing the audit chain, granting capabilities, and inspecting memory tiers.

cd agent-os/covenant-webpnpm install --ignore-workspacepnpm dev   # http://localhost:3000

The console proxies the daemon's HTTP gateway, injects the operator bearer token server-side, and renders every dispatch as a verifiable trace through the hash-chained audit log. See examples/hello-agent for the agent walkthrough, docs/demo.md for a CLI transcript, and deploy/README.md for shipping the console as a public sandbox on Render.

TypeScript SDK

Agent authors building on the deployed Solana settlement program can install @covenant-org/sdk from npm:

npm install @covenant-org/sdk @solana/web3.js

It turns every Covenant instruction (agent registration, $CVNT staking, task escrow, credit purchase, receipt anchoring) into a signed @solana/web3.js transaction, with the wire bytes encoded from the on-chain program IDLs so they cannot drift from what the program accepts. Apache-2.0, one runtime dependency. Source lives in packages/sdk.

Why Covenant

Software agents are moving from interactive assistance toward long-running engineering work. That shift changes the infrastructure problem. Agents need durable context, explicit authority, reliable tool access, recovery after interruption, and a record of what happened.

Conventional developer environments assume a human operator is present at every step. Blockchain systems assume verifiable state transitions, explicit authority, and durable coordination across independent actors. Covenant brings those assumptions into agent infrastructure:

• Governance: intents, manifests, scoped permissions, review gates, and policy-aware dispatch.
• Continuity: persistent memory, resumable task state, repair workflows, and structured handoff.
• Accountability: append-only audit logs, integrity reports, signed actions, and commit-scoped provenance.
• Interoperability: native tools, MCP integration, A2A messaging, local gateway APIs, and protocol adapters.
• Execution: daemon-mediated runtime dispatch with budget enforcement and sandbox-aware agent manifests.
• Settlement: local receipts and protocol scaffolding for accountable resource use and agent coordination economics.

Architecture

The system center is covenantd, a Rust daemon that owns local state and mediates privileged operations through IPC, an HTTP gateway, signed capabilities, audit logs, memory stores, and runtime dispatch.

Audit underlies Identity, Permissions, and Settlement — append-only JSONL events, local hash-chain integrity reports, retention controls, signed actions, and audit-root attestations. The primary implementation lives in agent-os/, the Rust workspace containing the daemon, CLI, TUI, protocol crates, runtime, memory, identity, permissions, peer authentication, audit, MCP and A2A adapters, budget ledger, and settlement components. The surrounding monorepo contains public documentation, web surfaces, circuits, SDK packages, and supporting services.

See docs/audit-integrity.md, docs/capabilities.md, and agent-os/README.md for implementation details and validation evidence.

Capabilities

Covenant includes:

• Rust daemon and CLI for local agent orchestration.
• IPC and local HTTP gateway surfaces.
• Signed capability lifecycle for implemented namespaces, including grant-time validation, expiry, revocation, and dispatch-time scope enforcement.
• Peer authentication, operator token rotation, peer revocation, and peer-scoped A2A checks.
• Append-only audit log with structured event types, bounded reads, retention purge, and local hash-chain verification.
• SQLite-backed project memory across working, episodic, and long-term tiers.
• MCP adapter, native tool integration, and A2A mailbox primitives.
• Budget ledger primitives with daemon-backed pause checkpoint storage for budget exhaustion, shutdown drains, and single-use resume handoff.
• Local settlement receipts for resource accounting.
• Agent-to-service payments over HTTP 402 (x402): the daemon can pay for metered resources outbound, and Covenant operates a live x402 seller that settles in USDC on Solana mainnet (paid Covenant-Verified attestations, on-chain identity passports, and reputation reads), alongside an escrow service and an Ephemeral-Rollup credit facilitator.
• Multi-chain trust projection onto Base mainnet: ERC-8004 agent registration, a deployed bond-receipt verifier and EAS reputation schema, EAS off-chain attestations for audit roots and reputation, and an ENS CCIP-Read gateway (*.agents.opencovenant.eth) that resolves to the canonical Solana identity — each verifiable with one ecrecover, no bridge and no cross-chain token. On-chain reputation scores and funded USDC bonds are not yet exercised. The same stateless verifier design and x402 rail also reach Robinhood Chain mainnet (chain 4663): a USDG x402 payment has settled on mainnet in real USDG, and a SpendGrantEscrow contract enforces bounded agent spend with its charge, release, and refund loop proven on Robinhood Chain testnet, while the bond and reputation verifiers are deployed but not yet exercised and no ERC-8004 identity is projected there. See docs/multichain-value-capture.md.
• Commit-scoped provenance envelopes that bind task records, changed Git blobs, transition events, and validation evidence.
• Unsigned or locally signed audit-root attestations for local integrity reports, with release-target binding to release-subject and release-scope manifests so a single attestation covers the audit log, the release artifact set, and the in-scope task set.
• Opt-in live tests for daemon, CLI, runtime, and selected backend boundaries.
• Source-built local installer for the daemon and CLI with a relative-path install manifest.
• CI coverage for Rust, documentation, workflow linting, provenance verification, dependency audits, and CodeQL. Public live-test inventory comes from source; private workflow checkouts may add stricter matrix validation.

Validation

Run the scripts-only gate when the change does not need Rust tooling:

bash agent-os/scripts/validate.sh --scripts

Run the fast local gate from the repository root:

bash agent-os/scripts/validate.sh --quick

Run the full Rust validation gate:

bash agent-os/scripts/validate.sh

Verify committed provenance envelopes:

node agent-os/scripts/provenance.mjs verify-all

Build the public documentation surface:

pnpm --dir landing install --frozen-lockfile --ignore-workspacepnpm --dir landing build

Run live boundary tests when host prerequisites are available:

cd agent-oscargo test --workspace --exclude covenant-settlement-program -- --ignored live_

Inspect the public live coverage inventory:

bash agent-os/scripts/test-stats.sh

Research Direction

Covenant advances open infrastructure for:

• governed autonomous software maintenance;
• verifiable agent actions and commit-scoped provenance;
• capability-scoped delegation across local and remote agents;
• durable project memory for long-running work;
• resumable task ownership across interruptions;
• reproducible temporal state, correction, and proof-carrying replay;
• policy-aware tool use and sandboxed execution;
• audit-root attestations, public provenance, and agent coordination economics.

The Covenant Timeline integration applies the standalone Timeline kernel to release chronology. Its checked v0.1.0-alpha.1 run persists across a process restart, records an authoritative timestamp correction without rewriting the earlier state, and verifies proof-carrying conclusions at three historical record cuts with the exact published package @covenant-org/[email protected]. The original v0alpha1 checkpoint adapter remains available as a compatibility surface.

This is a shadow audit, not a release gate or a grant of authority. Timeline's preregistered frontier-model benchmark did not pass its standalone model-memory accuracy gate: it beat bounded narrative memory but did not beat stateless full-context structured extraction, producing a recorded decision of kill. Covenant uses the integration for deterministic temporal state, correction, replay, and proof verification—not as evidence that Timeline improves model accuracy. The complete benchmark result is public.

Citing

If you use Covenant in academic work or reference the design in a paper, please cite the whitepaper:

Covenant contributors. (2026). Covenant: A Capability-Based Operating Layer for Autonomous Software Engineering Agents. Zenodo. https://doi.org/10.5281/zenodo.20134416

@misc{covenant2026,  author    = {Covenant contributors},  title     = {Covenant: A Capability-Based Operating Layer for Autonomous Software Engineering Agents},  year      = {2026},  publisher = {Zenodo},  doi       = {10.5281/zenodo.20134416},  url       = {https://doi.org/10.5281/zenodo.20134416}}

A copy of the PDF lives at opencovenant.org/paper.pdf; the LaTeX source is under paper/arxiv/.

Contributing

Covenant is systems infrastructure with security-sensitive boundaries. Contributions should include a validation plan, tests for changed behavior, and a clear statement of operational impact.

Start with CONTRIBUTING.md and ROADMAP.md. Changes touching identity, permissions, audit, runtime isolation, settlement, provenance, release automation, or CI should receive especially close review.

Security

Follow SECURITY.md for responsible disclosure. The runtime isolation boundary is tracked in docs/runtime-sandbox-security.md. Do not open public issues for vulnerabilities.

License

Apache-2.0. See LICENSE.